agentfootprint 7.22.1 → 7.24.0

package/dist/core/agent/middleware/runChain.js

@@ -26,9 +26,19 @@
  * permission gate has always applied to a checker that throws: a
  * governance layer whose failure mode is "allow" is not a governance
  * layer.
+ *
+ * **The result comes back through the onion.** `runToolAfterChain` walks the
+ * SAME list in reverse, so the first-declared link gets the first word about
+ * the call and the last word about the result. An outer rule is the one that
+ * sees what every inner rule already did — which is the only order in which
+ * "wrap" means anything.
+ *
+ * **A link that has no hook for a moment files no row.** It did not decide;
+ * saying it allowed would be inventing a decision, and the ledger's whole
+ * value is that a row means somebody looked.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runMessageChain = exports.runToolChain = void 0;
+exports.runMessageChain = exports.runToolAfterChain = exports.runToolChain = void 0;
 /** Walk the tool chain. Never throws — a throwing link becomes a denial. */
 async function runToolChain(chain, input) {
     const decisions = [];
@@ -36,8 +46,13 @@ async function runToolChain(chain, input) {
     let args = input.args;
     for (let i = input.startIndex ?? 0; i < chain.length; i++) {
         const mw = chain[i];
+        // A result-only link takes no part in dispatch — and files no row here,
+        // because it did not decide anything about this call.
+        if (typeof mw.onToolCall !== 'function')
+            continue;
         const row = (extra) => ({
             middleware: mw.name,
+            moment: 'before-tool',
             at: 'tool',
             toolName: input.toolName,
             toolCallId: input.toolCallId,
@@ -50,6 +65,10 @@ async function runToolChain(chain, input) {
         try {
             outcome = await mw.onToolCall({
                 toolName: input.toolName,
+                // Present only when the tool HAS a source. An `undefined` key is not
+                // the same fact as an absent one to a middleware that spells its rule
+                // `'toolSource' in call`, and "the agent's own" is an absence.
+                ...(input.toolSource !== undefined && { toolSource: input.toolSource }),
                 toolCallId: input.toolCallId,
                 iteration: input.iteration,
                 args,
@@ -90,12 +109,90 @@ async function runToolChain(chain, input) {
             decisions.push(row({ changed: true, ...(outcome.why && { why: outcome.why }), before, after: args }));
         }
         else {
-            decisions.push(row({}));
+            // `allow(undefined, why)` — nothing moved, and the link said why it was
+            // comfortable. The reason belongs on the row of the call it permitted.
+            decisions.push(row(outcome.why ? { why: outcome.why } : {}));
         }
     }
     return { kind: 'allow', args, decisions };
 }
 exports.runToolChain = runToolChain;
+/**
+ * Walk the chain BACKWARDS over a finished call. Never throws — a throwing
+ * link becomes a denial, which at this moment means the model reads the
+ * reason instead of the result.
+ *
+ * Only called for a call that actually executed. A call the chain denied, or
+ * one still waiting on a person, has no result to decide about, and asking a
+ * rule about a result that does not exist would be the same fabrication the
+ * outcome union exists to prevent.
+ */
+async function runToolAfterChain(chain, input) {
+    const decisions = [];
+    const real = input.result;
+    let result = real;
+    // Reverse: first-declared saw the call first, so it sees the result last.
+    for (let i = chain.length - 1; i >= 0; i--) {
+        const mw = chain[i];
+        const hook = mw.onToolResult;
+        if (typeof hook !== 'function')
+            continue;
+        const row = (extra) => ({
+            middleware: mw.name,
+            moment: 'after-tool',
+            at: 'tool',
+            toolName: input.toolName,
+            toolCallId: input.toolCallId,
+            iteration: input.iteration,
+            outcome: 'allow',
+            changed: false,
+            ...extra,
+        });
+        let outcome;
+        try {
+            outcome = await hook.call(mw, {
+                toolName: input.toolName,
+                ...(input.toolSource !== undefined && { toolSource: input.toolSource }),
+                toolCallId: input.toolCallId,
+                iteration: input.iteration,
+                args: input.args,
+                result,
+                ...(input.error === true && { error: true }),
+                history: input.history,
+                ...(input.identity && { identity: input.identity }),
+                ...(input.signal && { signal: input.signal }),
+            });
+        }
+        catch (err) {
+            const reason = `middleware '${mw.name}' threw: ${err instanceof Error ? err.message : String(err)}`;
+            decisions.push(row({ outcome: 'deny', changed: true, why: reason, before: result, after: reason }));
+            return { kind: 'deny', reason, middleware: mw.name, result: real, decisions };
+        }
+        if (outcome.kind === 'deny') {
+            // `changed: true` on purpose: unlike a refusal before dispatch, this one
+            // DOES replace something. The real result rides `before` — often the
+            // only copy of it in the run.
+            decisions.push(row({
+                outcome: 'deny',
+                changed: true,
+                why: outcome.reason,
+                before: result,
+                after: outcome.reason,
+            }));
+            return { kind: 'deny', reason: outcome.reason, middleware: mw.name, result: real, decisions };
+        }
+        if (outcome.value !== undefined) {
+            const before = result;
+            result = outcome.value;
+            decisions.push(row({ changed: true, ...(outcome.why && { why: outcome.why }), before, after: result }));
+        }
+        else {
+            decisions.push(row(outcome.why ? { why: outcome.why } : {}));
+        }
+    }
+    return { kind: 'allow', result, decisions };
+}
+exports.runToolAfterChain = runToolAfterChain;
 /** Walk the message chain. Never throws — a throwing link becomes a denial. */
 async function runMessageChain(chain, input) {
     const decisions = [];
@@ -103,6 +200,7 @@ async function runMessageChain(chain, input) {
     for (const mw of chain) {
         const row = (extra) => ({
             middleware: mw.name,
+            moment: input.phase,
             at: 'message',
             phase: input.phase,
             iteration: input.iteration,
@@ -135,7 +233,7 @@ async function runMessageChain(chain, input) {
             decisions.push(row({ changed: true, ...(outcome.why && { why: outcome.why }), before, after: content }));
         }
         else {
-            decisions.push(row({}));
+            decisions.push(row(outcome.why ? { why: outcome.why } : {}));
         }
     }
     return { kind: 'allow', content, decisions };

package/dist/core/agent/middleware/runChain.js.map

@@ -1 +1 @@
-{"version":3,"file":"runChain.js","sourceRoot":"","sources":["../../../../src/core/agent/middleware/runChain.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AAgEH,4EAA4E;AACrE,KAAK,UAAU,YAAY,CAChC,KAAgC,EAChC,KAAqB;IAErB,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC;IAC7C,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAsB,EAAE,CAAC,CAAC;YACvE,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,EAAE,EAAE,MAAM;YACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,YACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxF,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,MAAM,GACV,eAAe,EAAE,CAAC,IAAI,4DAA4D;oBAClF,mBAAmB,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAChD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACxE,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,EAAE,CAAC,IAAI;gBACnB,KAAK,EAAE,CAAC;gBACR,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC;YACpB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;YACrB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CACtF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AA5ED,oCA4EC;AAyBD,+EAA+E;AACxE,KAAK,UAAU,eAAe,CACnC,KAAmC,EACnC,KAAwB;IAExB,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAsB,EAAE,CAAC,CAAC;YACvE,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,YACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3F,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;YACxB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CACzF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC/C,CAAC;AApDD,0CAoDC"}
+{"version":3,"file":"runChain.js","sourceRoot":"","sources":["../../../../src/core/agent/middleware/runChain.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;;;AAmEH,4EAA4E;AACrE,KAAK,UAAU,YAAY,CAChC,KAAgC,EAChC,KAAqB;IAErB,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC;IAC7C,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,UAAU;YAAE,SAAS;QAClD,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAsB,EAAE,CAAC,CAAC;YACvE,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,MAAM,EAAE,aAAa;YACrB,EAAE,EAAE,MAAM;YACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,qEAAqE;gBACrE,sEAAsE;gBACtE,+DAA+D;gBAC/D,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,YACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxF,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,MAAM,GACV,eAAe,EAAE,CAAC,IAAI,4DAA4D;oBAClF,mBAAmB,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAChD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACxE,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,EAAE,CAAC,IAAI;gBACnB,KAAK,EAAE,CAAC;gBACR,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC;YACpB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;YACrB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CACtF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,uEAAuE;YACvE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAtFD,oCAsFC;AA8BD;;;;;;;;;GASG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAAgC,EAChC,KAA0B;IAE1B,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,0EAA0E;IAC1E,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC;QAC7B,IAAI,OAAO,IAAI,KAAK,UAAU;YAAE,SAAS;QACzC,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAsB,EAAE,CAAC,CAAC;YACvE,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,MAAM,EAAE,YAAY;YACpB,EAAE,EAAE,MAAM;YACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM;gBACN,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,IAAa,EAAE,CAAC;gBACrD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,YACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CACpF,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAChF,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,yEAAyE;YACzE,qEAAqE;YACrE,8BAA8B;YAC9B,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC;gBACF,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE,OAAO,CAAC,MAAM;gBACnB,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,OAAO,CAAC,MAAM;aACtB,CAAC,CACH,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAChG,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;YACvB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CACxF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC;AA7ED,8CA6EC;AAyBD,+EAA+E;AACxE,KAAK,UAAU,eAAe,CACnC,KAAmC,EACnC,KAAwB;IAExB,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAsB,EAAE,CAAC,CAAC;YACvE,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,YACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3F,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;YACxB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CACzF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC/C,CAAC;AArDD,0CAqDC"}

package/dist/core/agent/middleware/types.js

@@ -36,6 +36,36 @@
  * `checkIn` and `askHuman` already go through. `MessageOutcome` does not,
  * because the message boundary is a plain stage, and inventing a second
  * pause to give it one would be a worse answer than not offering it.
+ * `ToolResultOutcome` does not either — see below.
+ *
+ * ## The two moments of a tool call
+ *
+ * A tool middleware may speak twice about one call:
+ *
+ *   `onToolCall`    BEFORE dispatch — about the call. Three verbs.
+ *   `onToolResult`  AFTER the tool ran, before its result enters the history
+ *                   or reaches the model — about the result. Two verbs.
+ *
+ * Each hook is named for what it RECEIVES; the moments they sit at are named
+ * `'before-tool'` and `'after-tool'` (and `.act()`'s keys after those).
+ *
+ * Either hook alone is a whole middleware; a link with only `onToolResult`
+ * does not take part in dispatch at all. The chain walks the two moments in **onion
+ * order**: the first-declared link sees the CALL first and the RESULT last —
+ * first word going in, last word coming out — which is the order that lets an
+ * outer rule inspect what every inner rule already did.
+ *
+ * **There is no `ask` at the after-tool moment.** Not because the machinery is missing —
+ * the dispatch loop pauses perfectly well — but because the tool has ALREADY
+ * RUN. A person woken to answer a question about a side effect that already
+ * happened cannot prevent it; the honest verbs there are "let the result
+ * through" and "do not let the model see it", and both are available now. The
+ * business cases this was measured against — authorize before, hide from the
+ * model, annotate the result, attach a fact through a context trigger — none
+ * of them needed a person at that moment. This is a refusal, not an oversight,
+ * and it is written here so evidence can promote it later: bring a case that
+ * genuinely needs a human at the after-tool moment and the arm can be added, on the
+ * pause machinery that already exists.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=types.js.map

package/dist/core/agent/middleware/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/agent/middleware/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/agent/middleware/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG"}

package/dist/core/agent/moments.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * moments — PUBLIC. The five places in the loop where a rule may speak.
+ *
+ * Pattern: Closed enumeration + a mechanical name mapping, with the mapping
+ *          pinned by the compiler rather than by memory.
+ * Role:    core/ layer. `LoopMoment` is the vocabulary `.act()` is keyed on
+ *          and the vocabulary every ledger row now stamps itself with, so a
+ *          person asking "where in the loop did this happen?" and a person
+ *          asking "where in the loop can I intervene?" are reading the same
+ *          five words.
+ * Emits:   N/A (types + one pure function).
+ *
+ * ## Why the list is here and not inside `.act()`
+ *
+ * A bundle whose keys ARE the moments is only honest while the two sets
+ * agree. Keep the list of moments in the options type and the sixth moment
+ * ships with no key and nothing notices; keep it here, derive the key names
+ * from it, and the day a moment is added the build fails inside `act.ts`
+ * naming the key nobody wrote. That is the same trick `conformSource` plays
+ * on the outside world, turned inward on ourselves.
+ *
+ * The mapping between the two spellings is mechanical — kebab in the record
+ * (`'before-tool'`, which reads as a phase), camel in the bundle
+ * (`beforeTool`, which reads as a property) — and `actKeyFor` is its runtime
+ * twin, so the validator that decides which keys `.act()` accepts is
+ * DERIVED from this list rather than typed out beside it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actKeyFor = exports.LOOP_MOMENTS = void 0;
+/**
+ * Every moment of one agent turn where a rule may act, in the order the loop
+ * reaches them.
+ *
+ * ```
+ * input → [ window → … LLM … → before-tool → tool → after-tool ]* → output
+ * ```
+ *
+ * `watch` attends all five and more; `act` attends exactly these. The
+ * difference is what a rule may DO there — an observer reports, a rule
+ * changes what happens next.
+ */
+exports.LOOP_MOMENTS = ['input', 'before-tool', 'after-tool', 'window', 'output'];
+/**
+ * The runtime twin of {@link ActKey}. `.act()`'s accepted key set is built
+ * from this over `LOOP_MOMENTS`, so an unknown key is refused by a rule that
+ * cannot fall behind the list it is derived from.
+ */
+function actKeyFor(moment) {
+    return moment.replace(/-(.)/g, (_match, c) => c.toUpperCase());
+}
+exports.actKeyFor = actKeyFor;
+//# sourceMappingURL=moments.js.map

package/dist/core/agent/moments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"moments.js","sourceRoot":"","sources":["../../../src/core/agent/moments.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAEH;;;;;;;;;;;GAWG;AACU,QAAA,YAAY,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAehG;;;;GAIG;AACH,SAAgB,SAAS,CAAC,MAAkB;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAW,CAAC;AACnF,CAAC;AAFD,8BAEC"}

package/dist/core/agent/stages/toolCalls.js

@@ -24,7 +24,7 @@
  * Gate order for one call, and why it is this order:
  *
  *   permission → MIDDLEWARE CHAIN → arg validation → check-in →
- *   credentials → execute
+ *   credentials → execute → THE CHAIN AGAIN, BACKWARDS (`onToolResult`)
  *
  * The chain sits after the permission gate so an existing checker still
  * decides first (a denial there means no middleware runs), and before arg
@@ -34,6 +34,11 @@
  * pauses on the SAME wire `checkIn` uses; the human's answer is a
  * decision, not a result, so the chain resumes and the REAL tool runs.
  *
+ * The last step is the same chain walked BACKWARDS over the result, before it
+ * becomes history — so the first-declared rule has the first word about the
+ * call and the last word about the answer. It runs only for a call that
+ * executed: everything the gates above refuse has no result to decide about.
+ *
  * `read_skill` is the auto-attached activation tool — when the LLM
  * calls it with a valid Skill id, the next InjectionEngine pass
  * activates that Skill (lifetime: turn).
@@ -73,6 +78,45 @@ function buildToolCallsHandler(deps) {
         const cached = providerToolCache?.current ?? [];
         return cached.find((t) => t.schema.name === toolName);
     };
+    /**
+     * The after-tool moment: the chain's last word, on a call that RAN.
+     *
+     * Called from all three dispatch sites (the loop, an approved ask, an
+     * approved check-in) and from nowhere else — every one of them has just
+     * executed a tool, which is the entire precondition. A call the chain
+     * denied, a call whose args were rejected, a call whose credential never
+     * issued and a call still waiting on a person have no result, and asking a
+     * rule about a result that does not exist would be the same fabrication the
+     * outcome union removes.
+     *
+     * Returns what the MODEL reads. The real result stays with the caller for
+     * `stream.tool_end`, so an event stream keeps reporting what the tool
+     * returned while the history carries what the rules allowed through — and
+     * the ledger row beside them says which is which.
+     */
+    const afterMoment = async (scope, call) => {
+        const chain = deps.toolMiddleware ?? [];
+        // No `onToolResult` hook anywhere in the chain → no walk, no rows, no await
+        // beyond the ones this dispatch already made. An agent whose middleware
+        // only governs calls is byte-identical to one built before this moment
+        // existed.
+        if (!chain.some((mw) => typeof mw.onToolResult === 'function'))
+            return call.result;
+        const verdict = await (0, runChain_js_1.runToolAfterChain)(chain, {
+            toolName: call.toolName,
+            ...(call.tool?.source !== undefined && { toolSource: call.tool.source }),
+            toolCallId: call.toolCallId,
+            iteration: call.iteration,
+            args: call.args,
+            result: call.result,
+            ...(call.error === true && { error: true }),
+            history: call.history,
+            ...(call.identity && { identity: call.identity }),
+            ...(call.signal && { signal: call.signal }),
+        });
+        (0, ledger_js_1.recordDecisions)(scope, verdict.decisions);
+        return verdict.kind === 'deny' ? verdict.reason : verdict.result;
+    };
     // Resolve a tool's declared credential (declare-and-push) and execute it,
     // emitting the same credential.* events as the main loop. Used by the
     // check-in RESUME path when a human APPROVES — the tool never ran at pause
@@ -137,16 +181,24 @@ function buildToolCallsHandler(deps) {
                 hasCredentials,
                 ...(resolvedCredential && { credential: resolvedCredential }),
             });
-            return { result };
+            return { result, executed: true };
         }
         catch (err) {
             if ((0, pause_js_1.isPauseRequest)(err)) {
                 return {
                     result: `tool '${toolName}' requested a pause while resuming an approved check-in, which is not supported`,
                     error: true,
+                    // It ran — a tool that asked to pause had already started work.
+                    executed: true,
                 };
             }
-            return { result: err instanceof Error ? err.message : String(err), error: true };
+            // A tool that threw still RAN, and may have done half its work; the
+            // after-tool moment exists precisely for the rules that care about that.
+            return {
+                result: err instanceof Error ? err.message : String(err),
+                error: true,
+                executed: true,
+            };
         }
     };
     return {
@@ -234,6 +286,8 @@ function buildToolCallsHandler(deps) {
                 // answer to "what did this call really run with".
                 let callArgs = tc.args;
                 let denied = false;
+                /** True once `tool.execute` has been entered — see `afterMoment`. */
+                let executed = false;
                 let haltContext;
                 if (permissionChecker) {
                     try {
@@ -309,6 +363,9 @@ function buildToolCallsHandler(deps) {
                 if (!denied && deps.toolMiddleware && deps.toolMiddleware.length > 0) {
                     const chain = await (0, runChain_js_1.runToolChain)(deps.toolMiddleware, {
                         toolName: tc.name,
+                        // Provenance from the tool that is about to run, so a policy can
+                        // scope to the server that served it. Absent for our own tools.
+                        ...(tool?.source !== undefined && { toolSource: tool.source }),
                         toolCallId: tc.id,
                         iteration,
                         args: callArgs,
@@ -497,6 +554,10 @@ function buildToolCallsHandler(deps) {
                         try {
                             if (!tool)
                                 throw new Error(`Unknown tool: ${tc.name}`);
+                            // Set BEFORE the await: a tool that throws has still run, and a
+                            // tool that does not exist has not. This flag is the entire
+                            // precondition of the after-tool moment below.
+                            executed = true;
                             result = await tool.execute(callArgs, {
                                 toolCallId: tc.id,
                                 iteration,
@@ -556,6 +617,24 @@ function buildToolCallsHandler(deps) {
                         }
                     }
                 }
+                // ── The after-tool moment ────────────────────────────────────────
+                // Last thing before the result becomes history, and only for a call
+                // that ran. `modelResult` is what the model reads; `result` stays the
+                // truth about the tool and is what `stream.tool_end` reports.
+                const modelResult = executed
+                    ? await afterMoment(scope, {
+                        ...(tool && { tool }),
+                        toolName: tc.name,
+                        toolCallId: tc.id,
+                        iteration,
+                        args: callArgs,
+                        result,
+                        ...(error === true && { error: true }),
+                        history: newHistory,
+                        ...(runIdentity && { identity: runIdentity }),
+                        ...(env.signal && { signal: env.signal }),
+                    })
+                    : result;
                 const durationMs = Date.now() - startMs;
                 (0, typedEmit_js_1.typedEmit)(scope, 'agentfootprint.stream.tool_end', {
                     toolCallId: tc.id,
@@ -563,7 +642,7 @@ function buildToolCallsHandler(deps) {
                     durationMs,
                     ...(error === true && { error: true }),
                 });
-                const resultStr = typeof result === 'string' ? result : (0, validators_js_1.safeStringify)(result);
+                const resultStr = typeof modelResult === 'string' ? modelResult : (0, validators_js_1.safeStringify)(modelResult);
                 newHistory.push({
                     role: 'tool',
                     content: resultStr,
@@ -670,12 +749,16 @@ function buildToolCallsHandler(deps) {
                     ? input
                     : (0, checkin_js_1.checkInDeclined)({ by: 'unknown', note: 'resume input was not a CheckInDecision' });
                 let result;
+                /** What the model reads. Differs from `result` only when a rule at the
+                 *  after-tool moment transformed or withheld it. */
+                let modelResult;
                 let error;
                 if (!decision.approved) {
                     result = decision.note ? `declined by human: ${decision.note}` : 'declined by human';
                     (0, ledger_js_1.recordDecisions)(scope, [
                         {
                             middleware: askedBy,
+                            moment: 'before-tool',
                             at: 'tool',
                             toolName,
                             toolCallId,
@@ -690,6 +773,7 @@ function buildToolCallsHandler(deps) {
                     (0, ledger_js_1.recordDecisions)(scope, [
                         {
                             middleware: askedBy,
+                            moment: 'before-tool',
                             at: 'tool',
                             toolName,
                             toolCallId,
@@ -709,8 +793,14 @@ function buildToolCallsHandler(deps) {
                     // model-visible refusal and the tool does NOT run. That is the same
                     // rule already applied to a tool that tries to pause during an
                     // approved check-in resume: at most one human question per resume.
+                    // Resolved BEFORE the chain runs, not after, because the links that
+                    // continue here must see the same `toolSource` the links before the
+                    // ask saw. A chain that changed its mind about where a tool came from
+                    // halfway through one dispatch would be worse than not knowing.
+                    const tool = lookupTool(toolName);
                     const rest = await (0, runChain_js_1.runToolChain)(deps.toolMiddleware ?? [], {
                         toolName,
+                        ...(tool?.source !== undefined && { toolSource: tool.source }),
                         toolCallId,
                         iteration,
                         args,
@@ -719,7 +809,6 @@ function buildToolCallsHandler(deps) {
                         askPolicy: 'refuse',
                     });
                     (0, ledger_js_1.recordDecisions)(scope, rest.decisions);
-                    const tool = lookupTool(toolName);
                     if (rest.kind === 'deny') {
                         result = rest.reason;
                     }
@@ -739,9 +828,30 @@ function buildToolCallsHandler(deps) {
                         const dispatched = await resolveCredentialAndExecute(scope, tool, toolName, rest.args, toolCallId, iteration, env);
                         result = dispatched.result;
                         error = dispatched.error;
+                        // The tool ran on this side of the pause, so the chain gets its
+                        // last word here too — a rule about results cannot be skipped by
+                        // routing a call through a human.
+                        if (dispatched.executed === true) {
+                            modelResult = await afterMoment(scope, {
+                                ...(tool && { tool }),
+                                toolName,
+                                toolCallId,
+                                iteration,
+                                args: rest.args,
+                                result,
+                                ...(error === true && { error: true }),
+                                history: [...scope.history],
+                                ...(scope.runIdentity && { identity: scope.runIdentity }),
+                                ...(env.signal && { signal: env.signal }),
+                            });
+                        }
                     }
                 }
-                const askResultStr = typeof result === 'string' ? result : (0, validators_js_1.safeStringify)(result);
+                // `modelResult` is only set where the after-tool moment ran; everywhere
+                // else the two are the same value.
+                if (modelResult === undefined)
+                    modelResult = result;
+                const askResultStr = typeof modelResult === 'string' ? modelResult : (0, validators_js_1.safeStringify)(modelResult);
                 const askHistory = [
                     ...scope.history,
                     { role: 'tool', content: askResultStr, toolCallId, toolName },
@@ -795,17 +905,38 @@ function buildToolCallsHandler(deps) {
                     ...(decision.note !== undefined && { note: decision.note }),
                 });
                 let result;
+                /** What the model reads — see the ask path above. */
+                let modelResult;
                 let error;
                 if (decision.approved) {
                     const env = scope.$getEnv();
-                    const dispatched = await resolveCredentialAndExecute(scope, lookupTool(toolName), toolName, args, toolCallId, iteration, env);
+                    const tool = lookupTool(toolName);
+                    const dispatched = await resolveCredentialAndExecute(scope, tool, toolName, args, toolCallId, iteration, env);
                     result = dispatched.result;
                     error = dispatched.error;
+                    // Consent moved the execution to this side of the pause; the rules
+                    // about results move with it.
+                    if (dispatched.executed === true) {
+                        modelResult = await afterMoment(scope, {
+                            ...(tool && { tool }),
+                            toolName,
+                            toolCallId,
+                            iteration,
+                            args,
+                            result,
+                            ...(error === true && { error: true }),
+                            history: [...scope.history],
+                            ...(scope.runIdentity && { identity: scope.runIdentity }),
+                            ...(env.signal && { signal: env.signal }),
+                        });
+                    }
                 }
                 else {
                     result = decision.note ? `declined by human: ${decision.note}` : 'declined by human';
                 }
-                const decisionResultStr = typeof result === 'string' ? result : (0, validators_js_1.safeStringify)(result);
+                if (modelResult === undefined)
+                    modelResult = result;
+                const decisionResultStr = typeof modelResult === 'string' ? modelResult : (0, validators_js_1.safeStringify)(modelResult);
                 const decisionHistory = [
                     ...scope.history,
                     { role: 'tool', content: decisionResultStr, toolCallId, toolName },